Photo credit: www.techradar.com
Researchers Identify Critical Vulnerability in Apache ParquetIt Enables Execution of Arbitrary CodeA Patch is Now Available, Users Advised to Update
Apache Parquet, a widely-utilized columnar storage file format, has been flagged for a critical vulnerability that could enable attackers to execute arbitrary code on compromised systems.
This file format is designed for high-efficiency data storage and processing, making it a popular choice within big data and analytics sectors, with major companies like Amazon, Google, Microsoft, and Meta relying on it for their operations.
The vulnerability, discovered on April 1, 2025, by Amazon security researcher Key Li, is cataloged as CVE-2025-30065 and is rated with a maximum severity score of 10 out of 10, indicating a critical security flaw.
Patch and Mitigations
According to a brief on the National Vulnerability Database (NVD), “Schema parsing in the parquet-avro module of Apache Parquet versions 1.15.0 and earlier allows malicious users to execute arbitrary code.” Users are strongly recommended to upgrade to version 1.15.1, which addresses this flaw.
The security issue arises from the deserialization of untrusted data, giving threat actors a pathway to control target systems through specifically crafted Parquet files.
However, the necessity for victims to be deceived into importing the malicious files suggests that the immediacy of the threat might be mitigated, despite the critical scoring of the vulnerability.
For those unable to promptly update their Apache Parquet installations to version 1.15.1, it is advised to refrain from using untrusted Parquet files or to thoroughly scrutinize them before engagement.
Moreover, IT departments are encouraged to enhance monitoring and logging of their Parquet processing environments in light of this vulnerability.
As of now, there have been no reports indicating that the vulnerability has been exploited in the wild. However, past patterns show that cybercriminals often begin scanning for vulnerable systems following the release of a patch, anticipating that some organizations may delay in implementing security updates.
Continuing coverage can be found on BleepingComputer
You might also like
Source
www.techradar.com